An Australian documentary has examined the potential cybersecurity risks linked to the country’s rapidly growing number of Chinese electric cars. It showed how automakers can access a wealth of information from each vehicle, with modern cars capable of collecting extensive data about driving conditions and, potentially, the people inside them.
The investigation focused primarily on two Chinese EV makers, Xpeng and BYD. In the case of Xpeng, an unnamed company insider allegedly monitored a G6 supplied to ABC News. They could report its location, speed, seat occupancy, steering-wheel angle, and other details. The company in China allegedly had access to this information and more.
The report also explored the potential national-security implications of Chinese vehicles, including the possibility that sensitive data could be sent to China. The concern is heightened when government officials drive these cars. The Australian Security Intelligence Organisation has advised ministers and public servants not to hold sensitive conversations in their vehicles or connect work devices to them, but there is no guidance specifying which cars they may purchase. Australia’s trade minister, Don Farrell, owns a BYD Shark 6, while the minister for climate change and energy, Chris Bowen, drives an Xpeng G6.
The Hacking Risk
ABC’s investigation went further by demonstrating what a hacker might do with unsupervised access to a vehicle. Dan Hreszczuk, a car cybersecurity specialist, was given a BYD Shark 6 pickup for two weeks. After finding a vulnerability, he was able to enter the vehicle’s systems with little difficulty. “The access we took advantage of didn’t even have a password,” he said.
Hreszczuk could lock the driver inside the vehicle, play music at high volume, and interfere with the wipers and lights while it was being driven. More seriously, he accessed the microphones inside the cabin. That allowed him to listen to potentially sensitive conversations, including phone calls, record a journalist’s voice, and capture the wake-up command from the journalist’s Apple phone before playing it through the Shark’s speakers.
After the hacker triggered “Hey Siri,” he added his own commands, prompting the iPhone to disclose various details. These included the user’s date of birth, telephone number, and the contact numbers stored in the phone—including the number of the Australian prime minister.
Should Drivers Be Worried?
The national-security concerns have already led countries including the UK and Poland to prohibit Chinese cars from sensitive sites. However, there is currently no evidence that China has instructed its automakers to spy on other nations. UK lawmakers did note last year that Chinese law gives the government legal rights to access data gathered by the cameras, sensors, and radar systems used in vehicles built with Chinese technology.
The investigation underscores serious questions about how modern cars collect, process, and protect data. But does that mean Chinese vehicles are inherently untrustworthy?
Automotive cybersecurity concerns are not new, and they are not limited to Chinese brands. A 2023 Mozilla study gave all 25 car brands it assessed its “Privacy Not Included” warning for their handling of consumer data. Nissan and Kia were found to monitor drivers’ “sexual activity” and owners’ “sex life,” respectively. The study also found that 84 percent of the brands surveyed sold collected data to third parties.
There have also been numerous reported cases involving hackers allegedly accessing vehicles from brands including Tesla, Kia, and Subaru. As cars and other connected devices gather increasing amounts of information about their users, the report suggests that every automaker may deserve closer scrutiny over its privacy and security practices.
The Toyota RAV4 remains a popular compact SUV, but its value and capabilities face strong competition from five hybrid alternatives.
Volkswagen has owned Bentley since 1998, but the luxury marque remains closely tied to its historic Crewe factory, where its current models are assembled in England despite their extensive German engineering and component links.
Tesla’s latest Roadster remains unconfirmed for production, but its dramatic debut included airborne stunts that few cars could match.
A fire at Frank Kent Cadillac in Fort Worth, Texas, destroyed six electric SUVs believed to be Cadillac Escalade IQs and took nearly 18 hours to bring under control.
A Ferrari F50 with just 106 miles on its odometer is expected to surpass $20 million at auction on October 31, potentially setting a new record for the model and highlighting its rapid rise in collector value.